I want to stop these particular messages in /var/log/messages
 

Dear All,

More than 7 G bytes were logged to the messages file last three weeks

I got this message in /var/log/messages

I want to stop this messaging cause it takes to much space


SAMPLE:

These are messages from the firewall (iptables). You can disable them editing the iptables rules, but I suggest to keep them in their own log file (e.g. /var/log/firewall) and establish a custom rule of logrotate to cycle them more often. See man syslog.conf and man logrotate for details.

Dear Cloucix thanks for the hint, can we find some exceptions with the help of that we get rid of these messages?

As told before, disable logging in the firewall itself.

Yes u r rite, But disabling is not an option,

What rule i should make to monitor traffic only from particular IPs and ignore all other
becoz all other IPs' logs are useless for me but filtering some pf IPs are necessary and we also want there logs

Disabling the firewall's logging is overkill. It looks like it's mainly UDP packets for ports 123 and 10100 that are causing the excessive logging. You could insert some ACCEPT and/or DROP rules matching those packets at the top of the chains. That would put an end to this, and it lets you be very specific as to which packets you don't want to log. For example, if you want to disable logging only for locally generated UDP packets with destination port 123 on them which exit on eth1, you could execute either a:Or a:...depending on whether you want to allow or deny the packet. Either command would prevent the packet from reaching whatever LOG rule it's currently hitting, and you can easily add more matches such as destination IP, for example.

Thnx alot Win32sux... its very much clear to me now,

But kindly tell me also if i really want to exclude an IPs [172.26.16.16] and [172.26.16.28] from monitoring and/or logging, what should be the rule for this?

It depends. Ideally, you'd want to create an exception right before the rule which currently sends the packet to the logging chain. This new rule would either ACCEPT/DROP/REJECT the packet, or send it to another chain which is set up differently than the logging one. That said, inserting a rule at the top of the chain would work just fine, and it would go like:Change the target from ACCEPT to DROP if your objective is to filter packets with those source IPs.